PT-2025-26840 · Onetrust · Onetrust Sdk

Published 2025-06-25 · Updated 2025-06-26 · CVE-2024-57708

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: OneTrust SDK version 6.33.0

Description: The issue allows a local attacker to cause a denial of service via the Object.setPrototypeOf, proto, and Object.assign components.

Recommendations: For OneTrust SDK version 6.33.0, consider disabling the use of Object.setPrototypeOf, proto, and Object.assign components as a temporary workaround until a patch is available.

Exploit

Fix

DoS

Resource Exhaustion

Prototype Pollution

Weakness Enumeration

CWE-400

CWE-1321

CWE-471

CWE-915

Related Identifiers

CVE-2024-57708

Affected Products

Onetrust Sdk

References · 8

• 🔥 https://exploit-db.com/exploits/52340 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-57708 · Security Note
• https://packetstorm.news/files/id/201222 · Note
• https://t.me/cvenotify/126653 · Telegram Post
• https://discord.com/assets/oneTrust/v4/scripttemplates/6.33.0/otBannerSdk.js · Note
• https://t.me/cvenotify/126722 · Telegram Post
• https://github.com/brotheralameen1/Discordforschool/security/advisories/GHSA-63xr-98vc-whx5 · Note
• https://twitter.com/CVEnew/status/1937898589537366165 · Twitter Post